diff --git a/articles/windows-mdm-setup.md b/articles/windows-mdm-setup.md index aeabe5a3b1..bbe09e7aec 100644 --- a/articles/windows-mdm-setup.md +++ b/articles/windows-mdm-setup.md @@ -83,7 +83,34 @@ In order to connect Fleet to Entra, the IT admin (you) needs a Microsoft Enterpr ### Step 2: Connect Fleet to Microsoft Entra ID -For instructions on how to connect Fleet to Microsoft Entra ID, in the Fleet UI, select the avatar on the right side of the top navigation and select **Settings > Integrations > Mobile device management (MDM)**. Then, next to **Windows automatic enrollment** select **Details**. +The end user will see Microsoft's default initial setup. You can further simplify the initial device setup with Autopilot, which is similar to Apple's Automated Device Enrollment (DEP). + +Some Intune/Entra deployments enable automatic enrollment into Intune. Check to ensure **Automatic Enrollment** is not enabled, or your devices will not appear in Fleet. + +In your Intune settings, select **Devices**, and under **Device onbarding**, open the **Enrollment** submenu. Select **Automatic Enrollment** and ensure both **MDM user scope** and **Windows Information Protection (WIP) user scope** are set to **None**. + +1. [Sign in to Azure portal](https://fleetdm.com/sign-in-to/microsoft-automatic-enrollment-tool). +2. At the top of the page, search "Domain names" and select **Domain names**. Select **+ Add custom domain**, type your Fleet URL (e.g. fleet.acme.com), and select **Add domain**. +3. Use the information presented in Azure AD to create a new TXT/MX record with your domain registrar, then select **Verify**. If you're a managed-cloud customer, please reach out to Fleet to create a TXT/MX record for you. +4. At the top of the page, search for "Mobility" and select **Mobility (MDM and WIP)**. +5. Select **+ Add application**, then select **+ Create your own application**. +6. Enter "Fleet" as the name of your application and select **Create**. +7. Set MDM user scope to **All**, then in the Fleet UI head to **Settings** > **Integrations** > **MDM** > **Windows Enrollment** and copy the URLs on the **Microsoft Entra** page (`/settings/integrations/automatic-enrollment/windows`). Paste them in Azure AD, and select **Save**. +8. While on this same page, select the **Custom MDM application settings** link. +9. Click on the **Application ID URI** which will bring you to the **Expose an API** submenu with an edit button next to the text box. +10. Replace with your Fleet URL (e.g. fleet.acme.com) and select **Save**. +11. Select **API permissions** from the sidebar, then select **+ Add a permission**. +12. Select **Microsoft Graph**, then select **Delegated permissions**, and select **Group > Group.Read.All** and **Group > Group.ReadWrite.All** and **Add permissions**. +13. Again select **+ Add a permission** and then **Microsoft Graph** and **Application permissions**, select the following: + + Device > Device.Read.All + + Device > Device.ReadWrite.All + + Directory > Directory.Read.All + + Group > Group.Read.All + + User > User.Read.All +14. Select **Add permissions**. +15. Select **Grant admin consent for [your tenant name]**, and confirm. + +Now you're ready to automatically enroll Windows hosts to Fleet. ### Step 3: Test automatic enrollment diff --git a/changes/17972-move-entra-instructions b/changes/17972-move-entra-instructions new file mode 100644 index 0000000000..65dcda2a9f --- /dev/null +++ b/changes/17972-move-entra-instructions @@ -0,0 +1 @@ +* Moved Windows automatic enrollment configuration instructions out of the UI and into the Windows MDM setup guide. diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/WindowsAutomaticEnrollmentPage.tsx b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/WindowsAutomaticEnrollmentPage.tsx index 1a34b6c35c..1e39b85c0e 100644 --- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/WindowsAutomaticEnrollmentPage.tsx +++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/WindowsAutomaticEnrollmentPage.tsx @@ -11,6 +11,7 @@ import CustomLink from "components/CustomLink/CustomLink"; import InfoBanner from "components/InfoBanner"; import Icon from "components/Icon"; import PageDescription from "components/PageDescription"; +import Card from "components/Card"; const generateMdmTermsOfUseUrl = (domain: string) => { return `${domain}/api/mdm/microsoft/tos`; @@ -39,198 +40,46 @@ const WindowsAutomaticEnrollmentPage = () => { - The end user will see Microsoft's default initial setup. You - can further simplify the initial device setup with Autopilot, - which is similar to Apple's Automated Device Enrollment - (DEP).{" "} + To connect Fleet to Microsoft Entra, follow the instructions in + the{" "} } /> -

- Some Intune/Entra deployments enable automatic enrollment into Intune. - Check to ensure Automatic Enrollment is not enabled, or your - devices will not appear in Fleet.{" "} -

-

- In your Intune settings, select Devices, and under{" "} - Device onbarding, open the Enrollment submenu. Select{" "} - Automatic Enrollment and ensure both MDM user scope and{" "} - Windows Information Protection (WIP) user scope are set to{" "} - None. -

- {/* Ideally we'd use the native browser list styles and css to display - the list numbers but this does not allow us to style the list items as we'd - like so we write the numbers in the JSX instead. */} -
    -
  1. - 1. - +

    + You will need to copy and paste these values to create the + application in Microsoft Entra. +

    +
    + -
    2. -
  2. - 2. -

    - At the top of the page, search “Domain names“ and select{" "} - Domain names. Then select + Add custom domain, type - your Fleet URL (e.g. fleet.acme.com), and select Add domain - . -

    -
    3. -
  3. - 3. -
    -

    - Use the information presented in Azure AD to create a new TXT/MX - record with your domain registrar, then select Verify. -

    - -
    - -

    - If you're a managed-cloud customer, please reach out to - Fleet to create a TXT/MX record for you. -

    -
    -     -
    -
    4. -
  4. - 4. -

    - At the top of the page, search for “Mobility“ and select{" "} - Mobility (MDM and WIP). -

    -
    5. -
  5. - 5. -

    - Select + Add application, then select{" "} - + Create your own application. -

    -
    6. -
  6. - 6. - Enter “Fleet” as the name of your application and select{" "} - Create. -
    7. -
  7. - 7. -
    -

    - Set MDM user scope to All, then copy the URLs below, - paste them in Azure AD, and select Save. -

    -
    - - -
    -
    -
    8. -
  8. - 8. -

    - While on this same page, select{" "} - Custom MDM application settings link. -

    -
    9. -
  9. - 9. -

    - Click on the Application ID URI which will bring you to the{" "} - Expose an API submenu with an edit button next to the text - box. -

    -
    10. -
  10. - 10. -

    - Replace with your Fleet URL (e.g. fleet.acme.com) and select{" "} - Save. -

    -
    11. -
  11. - 11. -

    - Select API permissions from the sidebar, then select{" "} - + Add a permission. -

    -
    12. -
  12. - 12. -

    - Select Microsoft Graph, then select{" "} - Delegated permissions, and select{" "} - Group > Group.Read.All and{" "} - Group > Group.ReadWrite.All and Add permissions. -

    -
    13. -
  13. - 13. -
    - Again select + Add a permission and then{" "} - Microsoft Graph and Application permissions, select - the following: -
      -
    • Device > Device.Read.All
      • -
    • Device > Device.ReadWrite.All
      • -
    • Directory > Directory.Read.All
      • -
    • Group > Group.Read.All
      • -
    • User > User.Read.All
      • -
    -
    -
    14. -
  14. - 14. -

    - Select Add permissions. -

    -
    15. -
  15. - 15. -

    - Select Grant admin consent for <your tenant name>, - and confirm. -

    -
    16. -
  16. - 16. -

    - You're ready to automatically enroll Windows hosts to Fleet. -

    -
    17. -
+ + + ); diff --git a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/_styles.scss b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/_styles.scss index 9fe80b0fdf..e526c6b6bb 100644 --- a/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/_styles.scss +++ b/frontend/pages/admin/IntegrationsPage/cards/MdmSettings/WindowsAutomaticEnrollmentPage/_styles.scss @@ -1,28 +1,10 @@ .windows-automatic-enrollment-page { @include vertical-page-layout; - p { - margin: 0; - } - - &__setup-list { - font-size: $x-small; - display: flex; - flex-direction: column; - gap: $pad-large; - padding: 0; - margin: 0; - max-width: 800px; - list-style: none; - - li { - display: flex; - flex-direction: row; - gap: $pad-small; - - p { - margin: 0; - } + &__card { + max-width: $settings-form-max-width; + p { + margin-top: 0; } } @@ -30,21 +12,12 @@ display: flex; flex-direction: column; gap: $pad-icon; - margin-top: $pad-large; } &__url-input { margin-bottom: 0; } - &__permissions-list { - margin-top: $pad-large; - list-style: disc; - display: flex; - flex-direction: column; - gap: $pad-medium; - } - &__cloud-customer-banner { margin-top: $pad-large; } diff --git a/website/config/routes.js b/website/config/routes.js index b5876e1a94..2c881568a5 100644 --- a/website/config/routes.js +++ b/website/config/routes.js @@ -1185,7 +1185,7 @@ module.exports.routes = { 'GET /learn-more-about/built-in-variables': '/docs/configuration/yaml-files#variables', 'GET /learn-more-about/disable-entra-conditional-access': '/guides/entra-conditional-access-integration#disable', 'GET /learn-more-about/available-fma-versions': 'https://github.com/fleetdm/fleet/tree/main/ee/maintained-apps/outputs', - 'GET /learn-more-about/connect-microsoft-entra': '/guides/windows-mdm-setup#automatic-enrollment', + 'GET /learn-more-about/connect-microsoft-entra': '/guides/windows-mdm-setup#step-2-connect-fleet-to-microsoft-entra-id', 'GET /learn-more-about/macos-configuration-profiles-same-scope': '/guides/custom-os-settings#upgrading-to-4-71-0', 'GET /learn-more-about/disable-okta-conditional-access': '/guides/okta-conditional-access-integration#disabling-okta-conditional-access', 'GET /learn-more-about/deploy-self-service-to-ios': '/guides/software-self-service#deploy-self-service-on-ios-and-ipados',